Security Information and Event Management

From MgmtWiki
Revision as of 19:57, 5 November 2021 by Tom (talk | contribs) (Gartner Magic Quadrant)

Jump to: navigation, search

Full Name

SIEM = Security Information and Event Management

Originally this term was applied to data collection about the security state and events in an enterprise. It has since broadened to cover pro-active security state determination and remediation of cyber threats as well, although often under a wide variety of different names.

Context

  • Web sites have long kept logs of incoming HTTP traffic to diagnose web site problems.
  • Core functionality of a SIEM includes log management and centralization, security event detection and reporting, and search capabilities.

References

  1. Wikipedia page on SEIM
  2. Connect to the Intelligent Security Graph using a new API is a Microsoft variant for the Azure cloud current as of 2018-04-17.
  3. Collect and consume log data from your Azure resources

Solutions

Gartner Magic Quadrant

The companies that were in the visionary half of the 2021 chart were ranked in the following order.

Vendor Cloud AI Location Notes
Exabeam Google user and entity behavior analytics SV CA
IBM QRadar Watson separate division everywhere
Securonix AWS forbes article and AIthority TX & India
Splunk open source comodo is one provider NJ
Rapid7 Erick Galinkin = Principal Artificial Intelligence Researcher SF CA
Logrhythm AWS AIthority Boulder
Gurucul Forbes article LA CA Identity Analytics
Microsoft Azure 1/2 of research budget WA
Sumo Logic multi-cloud cloud based
Fortnet

The leader of the field in longevity is ArcSight by Microfocus (after merger from HP) which is rather poorly rated by Gartner. They were the ones who identified the problem for the customer as "too much data" back in 2001. Microfocus targets legacy infrastructure.

References